Over 153,000 students, staff affected in Canvas data breach, Hong Kong privacy watchdog says

Hong Kong's privacy regulator has reported that over 153,000 students and staff from four local educational institutions were affected by a data breach in the online learning platform Canvas. The Office of the Privacy Commissioner for Personal Data (PCPD) revealed these findings after investigating the cyberattack that occurred in May. The initial report had claimed that 72,000 people were impacted.

The breach primarily affected City University of Hong Kong (CityU), with personal information of approximately 147,000 students and staff compromised. The Hong Kong Academy for Performing Arts (HKAPA) and Hong Kong Institute of Construction (HKIC) also experienced data loss, affecting around 4,500 and 2,300 individuals respectively. The extent of the breach at Hong Kong University of Science and Technology (HKUST) is still under verification.

The four affected institutions confirmed that their internal systems were not compromised by the incident. The PCPD noted that the universities had implemented security measures prior to the breach, such as pre-assessments of Canvas and contractual agreements with Instructure, the company operating Canvas. Despite this, the watchdog recommended that the affected institutions reassess data breach risks, strengthen monitoring of third-party platforms, and enhance data security measures.

The breach was attributed to vulnerabilities in a third-party platform and there was no indication that the institutions had failed to protect personal data. The PCPD suggested that organizations handling large volumes of personal data should conduct due diligence on third-party data processors, use on-premises servers, and develop incident reporting mechanisms.

Hong Kong has witnessed a rise in data security incidents in recent years, with the PCPD recording a 21% increase in data breach notifications in 2025 compared to the previous year.